fix: extend role-based access control in Quiz schema
- Updated authorization logic to allow both CENTER_MENTOR and CENTER_OWNER roles access to Quiz queries and mutations. - Enhanced security by refining user role checks to ensure proper access control.
This commit is contained in:
@@ -159,7 +159,7 @@ export class QuizSchema extends PothosSchema {
|
|||||||
if (!ctx.http.me) {
|
if (!ctx.http.me) {
|
||||||
throw new Error('Unauthorized')
|
throw new Error('Unauthorized')
|
||||||
}
|
}
|
||||||
if (ctx.http.me.role !== Role.CENTER_MENTOR) {
|
if (ctx.http.me.role !== Role.CENTER_MENTOR && ctx.http.me.role !== Role.CENTER_OWNER) {
|
||||||
throw new Error('Unauthorized')
|
throw new Error('Unauthorized')
|
||||||
}
|
}
|
||||||
const centerMentor = await this.prisma.centerMentor.findUnique({
|
const centerMentor = await this.prisma.centerMentor.findUnique({
|
||||||
|
|||||||
Reference in New Issue
Block a user